Not A Security“Boundary”
BreakingTrusts

Red teamer and offensive engineer
SpecterOps.io
I write lots of code :)2Red teamer, hunter, researcher
SpecterOps.io
I love shiny things :)3

4

Microsoft’s “What Are Domains andForests?” documentation

What If...
A computer in ForestA
authenticates* to acomputer ForestB
Full ticket-granting-tickets
could move across the trustfrom ForestA to ForestB
We had a way to easily
extract and reuse these
TGTs while in ForestB?
5*bonus if we can force theauthentication step :)1.
Kerberos in 60 secondsOK maybe a few minutes ;)6

Kerberos tl;dr✘ Kerberos is dense, and we don’t havetime to explain the entire protocol○Instead we’ll focus on a few key terms andpoints that are necessary to understandthe nuances of the trust attack✘ For a more in depth explanation, seeSean Metcalf’s post at
https://bit.ly/2JhbAXl
7

Kerberos tl;dr
1. An account authenticates to a domain controller (DC/KDC) by
encrypting some data with with a key derived from the user’spassword (e.g. RC4_HMAC(NTLM hash) or AES128/256_HMAC keys)
2.

If auth is successful, the DC returns a ticket granting ticket (TGT) tothe user that contains a privileged attribute certificate (PAC)○ The PAC is encrypted with the hash of the krbtgt (Kerberos ticketgranting-ticket service) account and contains auth information likethe user’s SID and groups they’re in.
8Kerberos tl;dr3.

The account requests a service ticket to a particular service
principal name (SPN) by presenting the TGT to the domaincontroller

4.

The DC returns a service ticket with the same auth info as the TGT.

5.

The user sends the service ticket to the target service/machine,which decides whether to grant the user access.
9

10

2.
Delegation
When You Need to be Someone Else

11

The Reason Delegation is Needed

User

Auth To“Pretend”
to be

Front EndService

User

Front
End
12

BackEndDelegation Types
Unconstrained

Traditional Constrained

A user requests a
forwardable TGT and sends
it to the remote service
with the service ticket.

The service requests a ticket
to itself as another user
ACL in a field (msDS(S4U2self)
AllowedToActOnBehalfOfOtherIdentity) on the target
The service uses this ticket
to request a service ticket to resource that dictates whoanother service as that user can perform S4U2proxy tothe resource(S4U2proxy).

The remote service
extracts the TGT from theservice ticket and uses it
to impersonate the user.

Service must be specified in
msDS-AllowedToDelegateTo
13

Resource-based
ConstrainedUnconstrained Madness✘ UNCONSTRAINED DELEGATION IS DANGEROUS!
✘ If an attacker can compromise a server with unconstraineddelegation, they can obtain the TGT for any (non-protected) user
who authenticates to that server✘ In modern domains, only domain controllers are configured for
unconstrained delegation by default○ But we often see “misconfigurations” in the field :)
14

15

3.
Domain Trusts:
Crash Course
16Trusts 101✘ Trusts link up the authentication systems of two domains○ This allows authentication traffic to flow between them✘ This is done by each domain negotiating an “inter-realm trust key”
that’s used to encrypt Kerberos referral tickets✘ Access is passed around with via these referrals and “inter-realm
ticket granting tickets"
17Trusts 201✘ Trust directions/transitivity:○ One-way - one domain trusts the other○ Two-way - both domains trust each other (2x one-way trusts)○ Transitive - A trusts B and B trusts C, so A trusts C✘ The main trust type categories we care about:○ Intra-forest - parent/child, cross-link (all transitive)○ Inter-domain - forest (transitive), external (non-transitive)

18

Privilege Attribute Certificates (PAC)✘ Recall: When you first authenticate, you receive a TGT○ Inside each TGT is a PAC○ A TGT’s PAC contains the user/group SIDs that identify the user
Ticket Granting Ticket
Privilege Attribute Certificate (PAC)
User

S-1-5-21-2532535433-4733566781-1284343941-1001

CORP\itadminGroups

S-1-5-21-2532535433-4733566781-1284343941-1353
S-1-5-21-2532535433-4733566781-1284343941-2604

CORP\FileShareAccess
CORP\HelpDesk

ExtraSids

S-1-5-21-3416895347-7456555532-9337766299-519

ACME\Enterprise Admins

19SID Filtering✘ During auth to another domain, the remote domain (the “trustingdomain”) analyzes the SIDs in the TGT’s PAC✘ Depending on the trust type, the remote domain removes (“filters”)
SIDs under various circumstances (see MS-PAC section 4.1.2.2)✘ E.g. when authenticating from ForestA to ForestB, the PAC fromForestA should not contain SIDs for a default set of privileged
groups in ForestB.
✘ Other cross-domain/forest group memberships can be exploited20

Intent of SID filtering
Stop a compromised trusted domain/forestfrom compromising a trusting domain/forest.
How well does this work in practice? Let’s find out...

21

Why The Domain != A Security Boundary

22

Why The Domain != A Security Boundary✘ The SID for “Enterprise Admins” is NOT filtered out by default forinter-realm tickets if both domains are within the same forest○ So if you can set your sidHistory to be “Enterprise Admins” (i.e.
ExtraSids in the PAC), you can escalate from a child domain tothe forest root domain!

23

Forests == A Security Boundary? 🤔
✘ SID filtering of sensitive groups DOES protect across Forest boundaries○Hence, people have assumed that Forests were a security boundary :)24Sidenote: “Authenticated Users” in Referrals

25Sidenote: Delegation and Trusts

26

So what? Let’s review✘ Delegated TGTs (like some TGTs found on unconstrained servers)
are usable across Forests boundaries.
✘ A compromised unconstrained delegation server means an an
attacker can extract TGTs of users who auth to that machine, even
if that user connects from another forest!
✘ Hmm…...can we coerce accounts to authenticate to an
unconstrained delegation server?
27

28

4.
The “Printer Bug”
Our Final Ingredient29

Printer Bug Overview✘ Abuses the old enabled-by-default Print System Remote Protocol(MS-RPRN).
✘ RPC Methods: RpcRemoteFindFirstPrinterChangeNotification(Ex)○ Purpose: “<ComputerA>, please send <ComputerB> a notification
when ____ happens” (e.g. when there’s a new print job)
○ When invoked, ComputerA will authenticate to ComputerB✘ This a way to coerce authentication. There are others and likely
more to come.
30

Reference: Printer Bug Details✘ Print System Remote Protocol (MS-RPRN)○○○○○

SMB-RPC (TCP 445)
Named Pipe: \pipe\spoolss
RPC UUID: 12345678-1234-ABCD-EF00-0123456789AB
Opnum 62 - RpcRemoteFindFirstPrinterChangeNotification
Opnum 65 - RpcRemoteFindFirstPrinterChangeNotificationEx✘ The RPC server is accessible by “Authenticated Users” on Windows>= 8 if the Spooler service is started (Server & Workstations have it
enabled by default).
○ Supposedly this will change in the future….
○ On Windows < 8 , seems possible if hosts have shared a printer.
○ Independently discovered by Elad Shamir (@elad_shamir)
31

Weaponization✘ SpoolSample - https://github.com/leechristensen/SpoolSample

LABDC01$
authenticated toWIN1032

5.
Breaking Forest Trusts
Smash Smash Smash

33

Scenario✘ An attacker completely compromises ForestB○This includes ForestB’s DC with unconstrained delegation ;)✘ ForestB shares a two way forest trust with ForestA✘ Tools Used:○ Rubeus○ SpoolSample○ Mimikatz

TGT monitoring/extraction
coerced authentication (the “printer bug”)
DCSync \m/34

The “printer bug”

DCADCB<- two-way
forest trust ->Compromised Forest (FORESTB)

Victim Forest (FORESTA)

tl;dr
The compromise of any server withunconstrained delegation (domaincontroller or otherwise) can not only beleveraged to compromise the current
domain and/or any domains in thecurrent forest, but also any/all domains
in any foreign forest the current forest
shares a two-way forest trust with!
37

Public Reaction?
(mostly good, but…)“Still a security boundary as
long as it is not a two waytrust AD forest/domain”“I just don't think I've
heard anyone claim aboundary still exists whena 2-way trust is in place.”
38“Step 1: Have forest root
domain admin credentials.
Step 2: Have things begrossly misconfigured.”Why This Matters✘ This attack works with default, modern configurations for Active
Directory forests as long as a two-way forest trust is in place.
✘ The security of ForestA is now completely dependent on thesecurity of ForestB (think acquisitions…)○ Even if ForestA has *near perfect* security it can be completelycompromised by the takeover of a single unconstrained delegation
server in ForestB!

39

Microsoft: A Great Example✘ We reported this to MSRC in the fall of last year
○The associated Microsoft engineering teams determined that it wasn’t avulnerability they would patch, but it would be something they might
harden in the future (i.e. v.Next)✘ After we published details (and defensive guidance) they decided
this decision was a mistake, and soon released an advisory (andeventually a patch!)✘ We applaud Microsoft/MSRC at admitting their error and handlingthe resulting situation in the best way possible!
40

41

6.
DefensesPreventing and Detection

42

Selective Authentication✘ “Selective authentication is a security setting that can be set oninterforest trusts. It provides Active Directory administrators whomanage a trusting forest more control over which groups of users ina trusted forest can access shared resources in a trusting forest.”✘ However, this is focused on administrative users○ Domain controller objects often need the “Allowed to authenticate”
right on foreign domain controllers in order for the system to work
correctly
43

Disabling Kerberos Full Delegation Across Trusts✘ To prevent ForestA from accepting delegated TGTs from ForestB:○ netdom trust foresta.local /domain:forestb.local/EnableTGTDelegation:no✘ This flips theTRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION
bit to prevent delegated TGTs from transiting the forest boundary✘ This has to be done on each end of the trust(s)!
44CVE-2019-0683 Details✘ As mentioned, Microsoft recently recognized this issue as CVE2019-0683✘ A patch is being slowly rolled out (see next slide) that disables TGT
delegation across forest trust boundaries by default✘ On the roadmap (July 2019)○ “...adding a new safe default configuration for unconstrained Kerberosdelegation across Active Directory forest trusts.”45

CVE-2019-0683 Timeline✘ March 12, 2019

○ Kerberos full delegation block is backported to Server 2008[R2]✘ May 14, 2019

○ A new trust flag will be introduced in case you need full delegation
across trusts○ "EnableTGTDelegation” set to “no” for all new trusts✘ July 9, 2019

○ Start of enforcement of new trust flag
○ "EnableTGTDelegation” ignored from this point forward46

thanks!
Any questions?
[will | lee]@specterops.io@harmj0y | @tifkin_47

References✘ Breaking Forests Trusts (Red) - https://bit.ly/2Ck1HlW✘ Breaking Forests Trusts (Blue) - https://bit.ly/2Y2Etd5✘ Attack Demo Video- https://bit.ly/2ULitRW✘ Microsoft Advisory- https://bit.ly/2ObHAv2✘ Microsoft Updates Timeline- https://bit.ly/2ugBZdM✘ CVE-2019-0683 details- https://bit.ly/2CopVLR48